Write File Type on Maldoc_Suspicious_OLE_target.yar

ac4c76d0 · donguk · 017f6458 · ac4c76d0
Commit ac4c76d0 authored Jun 13, 2018 by donguk
Show whitespace changes
Inline Side-by-side

Showing with 1 additions and 0 deletions

Maldoc_Suspicious_OLE_target.yar Malicious_Documents/Maldoc_Suspicious_OLE_target.yar +1 -0

No files found.
--- a/Malicious_Documents/Maldoc_Suspicious_OLE_target.yar
+++ b/Malicious_Documents/Maldoc_Suspicious_OLE_target.yar
@@ -3,6 +3,7 @@ rule Maldoc_Suspicious_OLE_target {
    description =  "Detects maldoc With Tartgeting Suspicuios OLE"
    author = "Donguk Seo"
    reference = "https://blog.malwarebytes.com/threat-analysis/2017/10/decoy-microsoft-word-document-delivers-malware-through-rat/"
+    filetype = "Office documents"
    date = "2018-06-13"
  strings:
    $env1 = /oleObject".*Target=.*.http.*.doc"/